You've left out the most critical piece of info; What does this company do? Do they make plastic childrens toys or top-secret military equipment?

I'll have a pop at this  . Most of this is based on what I know and am comfortable with now, in real life there'd be a lot more training and research into new tech etc.

$20,000(~£40,000) 5 - 20 users

Servers:
fairly middle of the road servers: HP DL380 or similar, Win 2k3 R2. Couple of DCs, one File and print, mabye one SQL if needed, one exchange box, one backup/AV/patch box, one web running Apache 2 on Redhat and one for Asterisk VoIP.
what's that about so far, £15k inc licences?

Workstations/Desktop:
Bog standard, of the shelf running XP SP2 (I'm not touching vista with a barge pole for the next year or so), locked down to the point of being almost unusable through AD. Except mine which would be the top of the line with as much memory as I could cram into it, dual booting XP & slackware maybe Ubuntu.
that takes the total up to about £25k.

Infrastructure:
2Mb ADSL moving up to 4 or 8 as needed. Cisco 1700 series router feeding into PIX 515e (Probably overkill, but DMZ is so easy with it and it will scale nicley when I need hot fail over on a fatter pipe later.), 48 port 3560 series for PoE to VoIP phones, one gig swicth for server (may be a cisco express as I'm running out of cash now...). All switch ports hard coded to accept one MAC. AC in server room.
That's about me spent up, if there's anything left I might treat my workers to a desk or two, maybe even a chair

Most of the money spent at this level would be actual kit to get the company running, the security coming mostly from policy and configuration.



$100,000
More of the same, scaling up with the users, maybe letting them have laptops if needed, but if wireless, certificates and RADIUS, EAP. If VPN required by now RSA type tokens. IDS sat somewhere, one in the DMZ first, maybe a second on the internal network.

$1,000,000
Now we're talking! put half of it to one side, we'll come to that in a second. Probably move a few of the servers to blades, for heat and space reduction, hot swapable/fail over everything  two net pipes from different providers. Move some of the services off Windows and on to *nix. Probably by some nice Macs for the arty types in the design dept. Couple of machines in the networks as honeypots. IPS installed (Cisco self healing network? with the client on the workstations that stops your machine from getting on the network if you're not patched up to the eyballs - I forget the Apps name). Open view running to keep an eye on things.

The half I put to one side would be given to HR and the legal dept to handle the occasions when we're sued/have to rehire because I've sacked people on the spot for leaving passwords on postits, propped open security doors with old power supplies, left hardcopies of confidential info in bins without shredding and generally done all the stupid things that you can't control with technology.

That is not a question of money. What you need is a concept - and the very same idea can be set up with $10.000,- or $100.000,-, the difference is reliability and the real level of security.

You can set up a system with a DMZ, an IDS, an IPS, firewall, proxy, mailserver etc. using just one Linux-Box - or a bunch of high-end servers, routers and appliances.

All depends on the needed level of security. As negrita pointed out you'll certainly not choose the option with one Linux-Box if you need to secure top secret information, the more applications runs on one system the more vulnerable it will be.

But for the scenario Don has described I would definitely go for the one Box solution to start with, it is easy to extend such a system as needed. I think the biggest problem in that scenario is who would be the person to do the job. A startup with 5 people will rarely hire a skilled admin ...